Security Operations 4

Mark wants to have a way to determine if attackers have modified files on a critical web application server. What type of tool should he deploy if he wants to be able to check for changes of this nature?

• Drive encryption

• File availability monitoring

• File encryption

• File integrity monitoring

Answer explanation

File integrity monitoring tools use hashes to validate that files match their original content. If the files change, the hashes will not match, allowing the tool to alert administrators that a change has occurred. Drive encryption and file encryption both protect the confidentiality of data but don't indicate changes without a signature. File availability monitoring is not a typical tool, although system or service availability monitoring is.

Katie's organization uses an IoC feed that helps her to identify new threats. A recent feed update includes the following hash for Emotet malware: cecc5bba6193d744837e689e68bc25c43eda7235 Where is Katie most likely going to be able to use this hash to identify potential attacks?

• Via her EDR tools

• Via her firewall

• Via her system logs

• All of the above

Answer explanation

Endpoint detection and response (EDR) tools are most likely to use hashing to match known malicious files like this. Firewalls may provide the capability, but system logs do not, ruling out the “all of the above” option.

Which of the following tools is best suited to deploying and maintaining a secure baseline for Windows systems for an entire enterprise?

• PowerShell

• Group Policy

• Manual configuration

• Script‐based deployments

Answer explanation

Group Policy is the most common way of deploying baselines throughout Windows organizations. Group Policy Objects (GPOs) are set and managed across the entire Active Directory organization, allowing them to be modified for groups or specific purposes while inheriting most settings from the top of the organizational structure. PowerShell is a scripting tool, and both PowerShell and Group Policy are commonly used for specific purposes, but GPOs are typically preferred at scale. Manual configuration is not recommended for an entire organization.

Perry wants to ensure that an unsecure protocol is secured when in transit through his local network. What solution could he adopt to ensure that this traffic is protected?

• Use SD‐WAN.

• Wrap the protocol using TLS.

• Encrypt all files that are sent using AES.

• Encrypt all files that are sent using SHA‐1.

Answer explanation

A common technique to ensure that traffic sent via unsecure protocols remains secure is to wrap it using TLS. SD‐WAN is used to manage external connectivity, and there is no mention of files, only of an unsecure protocol. Even if files were encrypted, the rest of the traffic might leak information. Hashing does not leave data recoverable, making it unusable for this type of use in almost all cases.

Annie wants to implement a passwordless authentication system. Which of the following would not meet her needs?

• Windows Hello

• A PIN‐based factor

• A cell‐phone authenticator application

• A FIDO2 security key

Answer explanation

Passwordless authentication avoids making users provide a password or PIN by using a proof of identity from a device or token. Windows Hello, cell‐based authenticator applications, and FIDO2 security keys all support this, but entering a PIN does not.

Laura wants to harden an ICS and SCADA devices her organization uses to manage critical infrastructure. The devices are old and unsupported, without recent updates. What hardening techniques are most likely to be available to her to help deal with these devices?

• Isolation

• Segmentation

• Adding host‐based firewalls

• Configuring host‐based IPS

Answer explanation

Since ICS and SCADA devices need connectivity as part of their design, Laura knows that using segmentation to place the devices in a secure network is likely her best hardening option. Isolating the devices would break the functionality of ICS/SCADA systems. Neither ICS nor SCADA devices typically have support for host‐based firewalls or host‐based IPS.

Bob uses an IoC feed to allow his SIEM to identify and correlate common malicious activity. What phase of the incident response process best describes this?

• Preparation

• Detection

• Containment

• Eradication

Answer explanation

The detection and analysis phases of the incident response process both commonly leverage IoCs to detect and then correlate information to identify incidents. Preparation might involve setting up threat feeds and building automations to help notify security administrators of issues. Containment and eradication may leverage threat data to help understand common actions taken by threat actors, but the SIEM detecting and correlating events is not typically part of containment or eradication.

Yael's organization has received a very convincing phishing email that has resulted in staff clicking on a malicious link. If Yael can't remove the email from inboxes, which of the following options will allow her to quickly prevent users from being compromised?

• Set up DNS filtering using the URL from the email.

• Disable the organization's Internet connection.

• Block inbound traffic from the phishing email's source IP.

• Enable reputation services for the email.

Answer explanation

Enabling DNS filtering based on the URL from the email is the most effective option listed. Disabling the organization's Internet connection will result in additional disruption. Blocking the email's source IP for an already received email will not be effective, nor will enabling reputation services for email after the email has already been received.

Nick is reviewing his system configurations and notes that logon event auditing settings on the system are set as shown in the example figure. What concern should he express about the setting?

• 1. Log files may fill up quickly.

• 1. Successful authentication will not be logged.

• 1. Failed authentication will not be logged.

• 1. Policy may not be enforced properly.

Answer explanation

Successful authentications will not be logged based on these settings. Having access to both successes and failures can be useful when investigating incidents, particularly if attackers have stolen credentials. Text‐based log files take up minimal space on most workstations and servers and should not be a significant concern. While the message notes that the policy may be overridden, Nick's primary concern should be missing log data.

Brian is reviewing vulnerabilities discovered as part of a vulnerability scan. He sees a score for a vulnerability of 3.0. What does he know about this vulnerability based on its score?

• It is a high‐severity vulnerability and should be addressed quickly.

• It is a low‐severity vulnerability and may not need to be addressed.

• It is a medium‐severity vulnerability and should be reviewed before being addressed.

• It is a critical vulnerability and should be addressed immediately.

Answer explanation

CVSS scores range from 0 to 10.0, with 10.0 being the most critical. A score of .1–3.9 is considered a low rating, meaning that Brian can take his time to review and remediate the risk. Scores of 4.0–6.9 are medium, 7.0–8.9 are high, and 9.0–10.0 are critical.